@olegarr You can configure custom alerts or use alerts from metrics to trigger whenever a machine is deallocated.
However, if you want to do this through PS, you can run the following command to list all the VM's and the timestamp of the action that triggered the deallocation.
Get-AzLog -Status Accepted -DetailedOutput | ?{$_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/deallocate/action"} | fl ResourceId,EventTimestamp
This command searches for the status "succeeded" in all the deallocate action which are occurring under the resource provider "Microsoft.Compute" and lists the timestamp and resource ID you need.
You can then the use that to calculate the timeframe.